Joseph Rowntree School City of York Council Internal Audit Report 2017/18

Headteacher: Mr Crane Date Issued: 02/05/18 Status: Final Reference: 15692/004

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction This audit was carried out on Wednesday 22nd and Thursday 23rd November as part of the Internal Audit plan for Children, Education and Communities for 2017/18. Schools are audited in accordance with a detailed risk assessment.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to Governors, the Headteacher and management that procedures and controls in the areas listed below are working adequately and are well controlled.

The audit reviewed processes and transactions in the following areas:

- Governance and Financial Management
- System Reconciliation
- Banking Arrangements
- Contracts, Purchasing and Authorisation
- Income
- Capital and Property
- Extended Schools Provision
- Human Resources
- Payroll and Staff Costs
- School Meals
- Pupil Numbers
- Data Protection and Information technology
- Insurance and Risk Management
- Joint Use Facilities
- Inventories
- Safeguarding
- Minibus Key Findings Several areas for improvement were identified during the course of the audit. The areas identified and are set out below with recommended actions to address the issues.

Of particular importance to address are issues related to the school’s finances, such as contractual documentation not being held and procurement documentation being insufficient for purpose. The school must be clear about the expected procedures staff are expected to follow for financial transactions.

Minibus records were not available during the audit therefore no opinion could be given on whether the school fulfilled their duty of care in this area. It was also noted that backups to the computerised records were not held in a separate location to the server. The risk was discussed during the audit but pending introduction of the new system the school accepted the risk.

A new IT system was recently acquired for maintaining inventory records and this was being populated at the time of the audit. It was stated that previous inventory records were not well kept so the new system was being populated from scratch. Whilst this is not unreasonable, comparison should still be undertaken against the previous records to check that items have been included in the new inventory or to identify items that are no longer held.

In addition to the findings from this audit, a recent investigation makes a number of recommendations regarding cash handling processes and stock records in particular with regard to the sale of revision guides to pupils. The school should ensure it implements appropriate actions to address the issues raised and to improve control over cash and items held for sale.

Overall Conclusions It was found that the arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance.

## 1 Scheme of Delegation

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Part of the Budget Management policy setting out delegated authority levels is incomplete | Staff delegated authority levels are not formally agreed by Governors. |

### Findings

Although the school has a budget management policy that has been reviewed and approved by Governors, appendix D of the policy, the CYC Delegated Authority Scheme Authorisation Certificate was blank and has not been updated for a number of years. The authorisation certificate sets out the levels of authority staff have to order goods, authorise invoices for payment, enter into contracts and approve new staff appointments, timesheets and pay adjustments. As such it is important that it is completed and agreed by governors so that staff have a suitable level of authority to undertake their job while maintaining clear financial controls.

### Recommendation

The budget management policy should be completely reviewed to ensure that all relevant sections are fully completed and comply with the wishes of the Governors.

### Agreed Action 1.1

This action is now complete. Appendices to the Budget Management Policy were approved by FGB on 19th March 2018 and a copy sent to the LA SBS Team for their records.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | SBM | Complete |

## 2 Register of Gifts and Hospitality

| Issue/Control Weakness | Risk | |------------------------|------| | The school does not have a register of gifts and hospitality. | Gifts may have been received that could influence purchasing decisions and Governors and staff at the school may be vulnerable to allegations of improper conduct in relation to the acceptance of gifts and hospitality. |

### Findings

A Gifts and Hospitality Register has not been established in which details of any gifts or hospitality received can be recorded.

### Recommendation

A Register should be introduced to record any gifts and hospitality received. The register should be signed off on an annual basis. Guidance should be provided to staff about what must be recorded and how to conduct themselves round benefits they may receive.

### Agreed Action 2.1

The register is now part of the Gifts and Hospitality Policy that was approved by FGB on 19th March 2018. This policy will be reiterated to all staff and included in the Staff Handbook that is due to be re-circulated to all staff ready for Sep 18.

| Priority | 3 | |----------|---| | Responsible Officer | SBM / Head’s PA | | Timescale | Sep 18 | 3 IT Procurement

| Issue/Control Weakness | Risk | |------------------------|------| | Insufficient documentation for a procurement exercise. | The school may be open to challenge and may not have got best value. |

Findings

A transaction of £15k for computers was identified and the documentation for the procurement exercise, including the required three quotations collected by ICT department were requested.

The quotations obtained were not in an acceptable format. These consisted of screenshots taken from the websites of well-known IT suppliers. The quotations did not outline the specification of each piece of equipment and were only for the computers and not for the monitors which made up over £2000 of the final costing. There were no comparisons of similar computers or monitors to justify why these particular items were chosen.

Recommendation

All staff should be reminded of correct procedures for procurement and the policies that they must follow. For all future procurement exercises proper procedures must be followed, including formal quotations for all parts of the expenditure.

Agreed Action 3.1

Procedures for procurement are to be re-iterated to all budget holders when Start Budget capitation budgets are confirmed to Heads of Departments. For procurement £5k-£100k where 3 written quotes are required, the specification will be drafted for review by the SBM to ensure that formal written quotes are received back comparing like for like options. IT procurement will be monitored closely as a key area of regular, medium spend.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | SBM / Fin Mgr | May 18 & ongoing |

## 4 Insurance Certificates

| Issue/Control Weakness | Risk | |------------------------|------| | Insurance documents were not on file for all lettings. | The school may incur losses in the event of an insurance claim. |

### Findings

Although the school was able to produce insurance documents for most lettings, 2 were not in place at the time of the audit.

### Recommendation

The school should ensure that all insurance documents are obtained.

### Agreed Action 4.1

The insurance documentation for the two lettings that came up on the audit as a gap have now been received and filed. With a significant volume of lettings, the Finance Manager keeps a spreadsheet tracker of all lettings paperwork (including insurance renewal dates) that will be reviewed with the SBM on a termly basis.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Fin Mgr | Complete |

## 5 Contracts register

| Issue/Control Weakness | Risk | |------------------------|------| | The schedule of contracts is not complete. | The school may miss a key part of a contract or SLA and incur additional costs, charges or penalties. |

### Findings

The school have a general list of external providers, however for several of these, physical contracts or Service Level Agreements have not been seen.

### Recommendation

The school should ensure that their schedule of contracts is complete and up to date and that they have copies of all agreements that the school has entered into.

### Agreed Action 5.1

This is an area of action yet to be completed – the Contract Schedule is to be reviewed and completed by SBM over Summer Holiday period. The school buys into many areas from the CYC Services for Schools and through the Facilities Maintenance Care Plan, so all safety critical items covered for this Financial Year.

Business critical contracts (for day to day operations) to be included are catering, ICT support and grounds maintenance.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | SBM | Sep 18 | 6 Sickness Self Certification Forms

| Issue/Control Weakness | Risk | |------------------------|------| | Self Certification forms are not always in place. | Failure to comply with the Council's Attendance Management Policy. The school may not manage instances of sickness effectively. |

Findings

A sample of 5 self certification forms for sickness were requested. In 1 instance there was a sick note but no self certification; 1 had a self certification but section 3 (Return to Work) was not completed; 3 had not returned any certification form (1 was now on maternity leave and 1 had left after a very short period so these are not being chased).

A list of all sickness is maintained, along with whether the relevant documentation has been received. Missing documentation is chased although after the departure of the SBM there is some difficulty escalating issue of staff not completing / returning forms. During the course of the audit it was agreed that these could be escalated to the Headteacher.

Recommendation

All staff should be reminded of the necessity of fully completing sickness documentation. Where there is an issue getting the forms returned these should be escalated to the Headteacher.

Agreed Action 6.1

An all staff reminder has been issued on sickness absence procedures and this will be included in the Staff Handbook that is due to be re-circulated to all staff ready for Sep 18. Responsibility has been transferred to the Office Manager who keeps a tracker of all Return to Work forms being completed and filed, with monthly staff absence returns sent to HR. The SBM is working with the HR Advisory service on the few cases of long term staff absences that need to be progressed.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Office Mgr | Complete |

### 7 Publication Scheme

| Issue/Control Weakness | Risk | |------------------------|------| | The publication scheme does not have the guide to information. | The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information (FOI). |

#### Findings

The school has a publication scheme but it does not have a guide to information available. The guide to information sets out where to find each of the types of information available from the school, what format it is in and any costs.

#### Recommendation

The ICO Publication Scheme with guide to information should be formally adopted and approved by the schools Governing Body. This should be published on the school website.

#### Agreed Action 7.1

FOI Publication Scheme including the guide to information has been drafted for GB approval due 1st May 18. Once approved the Publication Scheme will be uploaded onto the school's website.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | SBM | May 18 |

## 8 Data Breach Policy

| Issue/Control Weakness | Risk | |------------------------|------| | The school does not have a policy or written guidance regarding data breaches. | The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information (FOI). |

### Findings

The school does not have a policy or written guidance regarding data breaches. It is important for data breaches to be handled correctly to minimise repercussions from the breach and ensure that they are handled in accordance with ICO requirements.

### Recommendation

It is recommended that a Data Breach Policy is formally adopted and approved by the schools Governing Body or incorporated into a revised Data Protection Policy.

### Agreed Action 8.1

Veritau have recently been appointed as the school’s DPO and the school is buying into the annual support contract. The Information Security Incident Reporting (or Data Breach) procedure has been included as an appendix to the updated Information policy that has been drafted for GB approval due 1st May 18. Staff will then be briefed on the procedure that will be included in the Staff Handbook (for Sep 18).

| Priority | 3 | |----------|---| | Responsible Officer | SBM | | Timescale | May 18 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.